The Git Gazette

Wiresec Urgency Scale: 🚨 (1/5) — Historical references, no immediate action required

Field report from the Chrome DevTools perimeter: GoogleChrome/lighthouse has surfaced with references to two CVEs in recent pull request activity — CVE-2026-4800 and CVE-2021-23337. Before you sound the general alarm, these appear to be historical references rather than active threats against the current codebase.

CVE-2021-23337 is a known lodash prototype pollution vulnerability that sent shockwaves through the JavaScript ecosystem back in 2021. If these references are dependency-related cleanup work, that's exactly the kind of proactive security hygiene we like to see from a project this critical to the web performance monitoring ecosystem.

CVE-2026-4800 raises an eyebrow — that's a future year designation, which suggests either a typo, a testing reference, or documentation work. Without access to the specific PR context, I'm treating this as administrative rather than operational.

What's concerning is the absence of a SECURITY.md file in this high-profile repository. For a tool that audits web security best practices, Lighthouse should lead by example with clear vulnerability disclosure procedures. The repo shows zero unpatched vulnerabilities currently, which is reassuring, but transparency in security processes would complete the picture.

Action Item: Monitor for any security advisories related to these CVE references. Maintainers should consider establishing formal security documentation to match their stellar technical standards.

Current Threat Level: Green — historical housekeeping, not active vulnerabilities.

BREAKING: What started as a simple bug report has evolved into an existential crisis about the meaning of empty arrays in issue #14986, and dear readers, the philosophical implications are chef's kiss.

Our protagonist @benschwarz filed what seemed like a straightforward complaint: setting onlyAudits, onlyCategories, and skipAudits to empty arrays returns unexpected results. But oh, what drama ensued!

Enter @connorjclark with the plot twist of the century: "This is working as expected." Gasps from the audience. The crux of the matter? onlyCategories: [] (empty array) versus onlyCategories: null (no value) are apparently as different as night and day. The former filters out everything, while the latter ignores the setting entirely.

But @benschwarz wasn't having it! "My expectation was a little bit different: Empty array = no values are set," they fired back. The philosophical divide was clear: Is an empty container the same as no container at all?

In a stunning turn of events, @connorjclark proposed a diplomatic solution: throw specific errors when developers pass empty arrays ("which is never useful") and generic ones when no audits survive the filtering gauntlet.

Seven comments later, this case was marked closed — but the existential questions linger on.